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White Paper: Fuelling Business Growth With Security Across Hybrid and Multi-cloud Environments 


Introduction 


Organisations today are under pressure to digitally transform to optimise productivity and gain a competitive 
advantage. To do this, they are increasingly moving applications to cloud services to speed up software 
development without having to worry about provisioning servers or hardware. They also must support remote work 
to provide flexibility for employees and growing teams. On their digital transformation journeys, organisations face 
increased IT complexity with distributed applications across hybrid and multi-cloud environments, as well as the 
need to support a distributed workforce. 


This creates new demands for security to ensure it can scale to support applications across environments and fully 
enable business growth. It requires security to support applications and users across diverse environments, which 
each have their own platform architectures, features and capabilities. Security teams also need the flexibility to 
scale to support changing business needs, including organic growth and acquisitions. 


But they face numerous challenges adapting their security strategies to keep up with the increasing usage of cloud 
services and cloud-native development. This is due to visibility challenges with the ephemeral nature of cloud 
resources and infrastructure that can be quickly scaled up or down. It is also difficult to keep up with the increased 
productivity of developers and to prevent exposure to threats as access and permissions proliferate. 


While many organisations try to address these challenges by using multiple security solutions or platforms, they 
frequently face security incidents from common issues, including misconfigurations or overprovisioned access. 
Blind spots and gaps between tools also create visibility challenges. Additionally, while their tools might alert them 
about security vulnerabilities, security teams often fail to prioritise and remediate critical issues in time to protect 
their applications from attacks. As assets and applications proliferate across cloud environments, these challenges 
only multiply. 


Security teams need an effective strategy to secure applications across environments, providing pervasive visibility 
and access protection supporting the mobility of workloads. This paper explores the key elements for an effective 
application security approach with the flexibility to support rapid business growth and its demands for hybrid and 
multi-cloud environments. 


Organisations should look for a flexible approach that supports security teams, regardless of their skill sets, to 
provide full visibility of assets for efficient vulnerability remediation and a zero-trust approach to protect applications 
from attack across all environments. It should include rapid detection of security issues, along with the contextual 
insight and threat intelligence to prioritise actions that will have the strongest impact on risk mitigation. It should also 
provide simplified, centralised ways to set policies to safeguard assets. 


With an approach that addresses applications and access across their interconnected, dynamic multi-cloud and 
hybrid environments, security teams can optimise resources and operations to effectively manage risk and rapidly 
respond to threats. This enables security teams to efficiently scale to support rapid development and business 
growth. 


Security Challenges Associated With Digital Transformation 


Research from TechTarget’s Enterprise Strategy Group indicates a perfect storm of recent developments creating 
challenges for security teams. These include the increased complexity of IT environments, the proliferation of cloud- 
native applications from increased developer productivity, and visibility gaps across multiple public clouds, resulting 
in a wide range of security incidents. Security teams need an effective strategy to meet these challenges and 
enable the business to grow while ensuring their applications are secure and protected across different 
environments without requiring specialised skills. 


© 2023 TechTarget, Inc. All Rights Reserved. 
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Increased IT Complexity 


As organisations leverage digital transformation to increase productivity and gain a competitive advantage, it 
creates complexity and new demands on IT and security. Enterprise Strategy Group research shows that more than 
half (53%) of organisations say their IT environment is more complex or significantly more complex than it was two 
years ago.' Among those organisations, the top reason cited for the added complexity is the increase in remote and 
hybrid work (40%). Other top reasons for increased complexity include the changing cybersecurity landscape 
(35%), the increase in the number and types of endpoint devices (35%), new data security and privacy regulations 
(34%) and higher data volumes (34%). Further down the list, the need to use both on-premises data centres and 
public cloud providers was cited by 29% of respondents (see Figure 1). 


Figure 1. Reasons for IT Complexity 


What do you believe are the biggest reasons your 
organisation’s IT environment has become more complex? 
(Percent of respondents, N=392, five responses accepted) 


Increase in remote and hybrid work concerns 40% 
Increasing and/or changing cybersecurity landscape 35% 
Increase in the number and type of endpoint devices 35% 

New data security and privacy regulations 34% 


Higher data volumes 34% 


to change the way we operate 


Increase in applications leveraging new modern 
architectures 


The need to incorporate emerging technologies like 
Al/ML, advanced analytics, blockchain, etc. 


The need to use both on-premises data centres and 
public cloud providers 


Increase in the number and type of applications used 
by employees 


Shadow IT 21% 


Need to provide access to suppliers and 
business partners 
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Too many different vendors 15% 


Source: Enterprise Strategy Group, a division of TechTarget, Inc. 


Organisations can find effective ways to support growth and scale despite being challenged by these multiple areas 
of added complexity. 


1 Enterprise Strategy Group Research Report, 2023 Technology Spending Intentions Survey, November 2022. 
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Increasing Movement of Applications to Cloud Environments 


Organisations are also increasingly leveraging public cloud infrastructure to increase productivity and innovation 
with cloud-native development. They don’t have to worry about the underlying infrastructure or maintenance, while 
they can benefit from economies of scale with pay-as-you-go models from cloud service providers (CSPs). 


Enterprise Strategy Group application infrastructure modernisation trends research shows 88% of the organisations 
surveyed run production workloads on public cloud infrastructure/platforms, and organisations are increasingly 
moving their production workloads to the cloud.? It also shows that those who have moved their applications to the 
cloud have realised many benefits, including greater agility, lower infrastructure costs and faster deployment. 


Cloud adoption also enables DevOps, which shifts operations left to empower developers to provision their own 
infrastructure instead of waiting for IT or operations teams to provision servers. Developers can work more 
efficiently, with faster time to value than traditional application development methods. However, with increased 
software development productivity, this creates security and compliance challenges for cloud-native applications. 


Figure 2. Top Three Challenges Organisations Face With Cloud-native Applications 


What are the biggest challenges your organisation has faced, 
or expects to face, with its cloud-native applications? 
(Percent of respondents, N=387, multiple responses accepted) 


Security 
Meeting and maintaining compliance requirements 
Lack of performance monitoring/observability 


Source: Enterprise Strategy Group, a division of TechTarget, Inc. 


Organisations need an effective way to manage security risk to support the demands of the business to move to 
cloud-native development and deliver a higher volume and greater speed of releases. Security teams that can 
optimise efficiency to support this scale and growth, instead of impeding the adoption of newer technologies that can 
increase developer productivity and innovation, can play a strong role in enabling the business for better results. 


Managing Security Posture Across Multi-cloud Environments 


Supporting growth with cloud environments also requires security teams to support multi-cloud environments. 
Enterprise Strategy Group research on cloud security posture management shows that most organisations (94%) 
use multiple cloud infrastructure service providers, with the majority (69%) using three or more.? Although a majority 
of organisations (68%) said they have robust cloud security posture management solutions in place, they reported a 
variety of challenges, mainly around gaining the visibility and control they need to effectively manage risk across 
environments and teams, including achieving security consistency across their data centre as well as their cloud 
environments (cited by 30%). Other challenges include overly permissive service and user accounts (cited by 25% 
and 26%, respectively), manual security practices and processes not keeping pace with the speed of cloud-native 
app delivery (25%), lack of involvement in and control over development processes (24%), lack of visibility into 
public cloud infrastructure (22%) and insufficient understanding of cloud-native threats (18%, see Figure 3).4 


2 Source: Enterprise Strategy Group Research Report, Cloud-native Applications, May 2022. 
3 Source: Enterprise Strategy Group Research Report, Cloud Entitlements and Posture Management Trends, April 2023. 
4 Ibid. 
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Figure 3. Biggest Cloud Security Challenges for Organisations 


Which of the following represent the biggest cloud security challenges 
for your organisation? (Percent of respondents, N=383, multiple 
responses accepted) 


Maintaining security consistency across our own 
datacentre and public cloud environments where our 30% 
cloud-native applications are deployed 


Overly permissive service accounts 26% 


Manual security practices and processes cannot keep 
pace with cloud-native application development 
and delivery 


Overly permissive user accounts 


Our application development and DevOps teams do not 
involve our cybersecurity team due to fear of being 24% 
slowed down 


Customising best practices or creating custom 
at : : 24% 
policies/rules that are tailored for our business 
Monitoring Kubernetes clusters for 
misconfigurations/vulnerabilities 


Our development and DevOps teams do not have a 
- à f 22% 
clear understanding of cloud security requirements 
Lack of visibility into public cloud infrastructure hosting 22%, 
our cloud-native applications E 
Meeting prescribed best practices for the configuration of o, 
cloud-resident workloads and services E 
Managing role-based access control (RBAC) for 
f 18% 
Kubernetes environments 
Lack of understanding of the threat model for our cloud- 
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native applications and infrastructure ie 


Lack of clarity on the shared responsibility security model 17% 
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Our existing security tools do not support cloud-native 
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environments 


We have not experienced any challenges 
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Source: Enterprise Strategy Group, a division of TechTarget, Inc. 
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Organisations need an effective approach that addresses these challenges to protect their applications across 
environments. This requires a way to gain visibility and control of the applications no matter where they reside, with 
a way to view them all as if they were in an interconnected, dynamic environment instead of separate 
environments. Bringing information together from multi-cloud and hybrid environments increases efficiency for 
security operations to mitigate risk and respond quickly to threats. This is the only way security can scale to support 
business growth with increasing cloud footprints. 


A Wide Range of Security Incidents 


Although organisations typically have multiple security solutions in place, most of them have experienced security 
incidents involving their cloud-native applications or infrastructure. Specifically, the research shows that 94% of 
organisations reported facing security incidents with attacks and/or lateral movement in the past 12 months ranging 
from stolen credentials (29%), to misconfiguration exploitation (29%), to data loss via insecure use of APIs (24%), to 
ransomware (16%, see Figure 4).° 


These occurred either because the organisations were unaware of their exposure to risk or because they were 
unable to remediate security issues in time to prevent or contain incidents. This underscores the need for visibility 
across environments, as well as the need for a platform approach to drive efficient security operations prioritising 
actions that have the highest impact on risk reduction. 


5 Ibid. 
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Figure 4. Types of Security Incidents Involving Cloud-native Applications and Infrastructure Over 
the Past Year 


Which of the following cybersecurity incidents, if any, has your 
organisation experienced in the last 12 months related specifically to 
cloud-native applications and infrastructure? (Percent of respondents, 
N=383, multiple responses accepted) 


The unauthorised or malicious use of a privileged 


0, 
account, secrets or access keys via stolen credentials 234 
Exploit of a misconfigured cloud service, workloads, 29%, 
security group and/or privileged account s 
The misuse of a privileged account by an employee 2 
Malware that moved laterally to cloud workloads 2 
Attacks that resulted in the loss of data due to the 
. 24% 
insecure use of APIs 
Multiple misconfigurations created an attack path to 
24% 
a breach 
Exploit(s) that took advantage of known vulnerabilities 24% 


‘Zero day’ exploit(s) that took advantage of new and 


o0, 
previously unknown vulnerabilities 22% 


Unauthorised access by a third party 21% 
Exposed or lost data from an object store 18% 
Ransomware 16% 


Targeted penetration attacks 15% 


We haven't experienced an incident in the last 
12 months 


HII 
oo 


6% 


Source: Enterprise Strategy Group, a division of TechTarget, Inc. 
Too Many Siloed Tools and Data 


Another challenge for organisations is the frequent use of multiple, siloed tools across IT, network and security 
teams, which slows down security operations. While traditional application security utilises multiple security 
products to ensure coverage, with testing and monitoring to detect security issues, it doesn’t scale for cloud-native 
applications and the increasing speed of development cycles to keep adding multiple separate tools that generate 
alerts without the context to determine how to prioritise needed actions. 
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Developers and security teams can’t keep up with the 
33% Reported Aggregating Results From high number of alerts from multiple products. Also, 


Multiple Security Products As a Major separate tools are often built in different languages, 
Challenge making it difficult to analyse their results for the context 
When security staff has to collate data from needed to prioritise what needs attention. Furthermore, 
several independent security technologies, each tool might generate alerts or false positives that 
overall security operations becomes overly would waste time to address. 


complex and time-consuming. 
Enterprise Strategy Group research shows that managing 
multiple tools creates challenges for cybersecurity staff, 
including the need for training and time to deploy and manage each tool, cited by 45% of respondents. 
Organisations also reported that it is difficult to get a complete picture of security status from separate tools (36%) 
and that aggregating the results from the separate tools creates more work for security staff (33%, see Figure 5).° 


Figure 5. Challenges of Managing Multiple Security Products 


Which of the following represent the biggest challenges associated with 
managing an assortment of security products from different vendors? 
(Percent of respondents, N=280, three response accepted) 


Each security technology demands its own training, 


implementation, management and operations, straining 


my organisation’s resources 
It is difficult to get a complete picture of our security status 
using many disparate security technologies > 


The security staff has to aggregate results from 


independent security technologies, making overall security 


operations complex and time-consuming 
My organisation doesn’t have enough staff or skills to 
manage our security technologies appropriately > 


We need different solutions for different infrastructure 


environments, which are managed by separate teams, 


creating operational inefficiencies 


Purchasing from a multitude of security vendors adds cost 
and purchasing complexity to my organisation Š 


All of our security products generate high volumes of 


security alerts, making it difficult to prioritise and 
investigate security incidents 


Source: Enterprise Strategy Group, a division of TechTarget, Inc. 


6 Source: Enterprise Strategy Group Complete Survey Results, ESG/ISSA Cybersecurity Process and Technology Survey, June 2022. 
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As a result, organisations are moving to products and services that work across CSPs to gather needed data and 
present it holistically. This helps security teams more effectively manage security risk, including efficient vulnerability 
management, attack surface management, and attack path analysis for a better understanding of security 
exposure. 


Overprovisioned Network Access 
A Unified Platform Across Hybrid and 


Multi-cloud Environments Can Provide: Managing identities and secure access also plays a key 
role in security programme effectiveness. This is because 


cloud-native development makes it easy for organisations 
and their developers to deploy their applications to the 


e Least privilege access, with centralised 
controls stopping lateral movement. 


e Pervasive visibility into asset discovery cloud and make them available for customers, employees 
and attack path management for all and partners. Once deployed to the cloud, the applications 
applications, workloads and resources. are available for the intended users, but access needs to 


be managed properly to mitigate risk and exposure that 
could put company and customer data at risk. In other 
words, in the cloud, there is no perimeter to protect 
workloads; identity and access form the perimeter. 


e High-fidelity insights, actions and 
priorities for SecOps teams, providing 
security posture from a single source of 
truth. 

Looking at the cloud-native security challenges and 

incidents mentioned earlier, many are related to identity 
and access issues. This is because it is easy to over-provision access to facilitate rapid development, but if not 
properly managed, increased access expands the attack surface and an organisation’s exposure to risk by leaving 
applications open to attack or making it easy for an attacker to move laterally after penetrating a system. 


Implementing a zero-trust network access (ZTNA) approach helps protect applications by ensuring that every 
access request is verified before connections are made, enabling security teams to minimise the likelinood and 
impact of an incident. So if a workload or application is compromised, a zero-trust environment would prevent 
accessing or egressing data. Enterprise Strategy Group research shows that a vast majority of organisations (97%) 
either have or are in the process of implementing Zero trust initiatives to ensure they can better protect their 
workloads across environments.’ 


7 Source: Enterprise Strategy Group Complete Survey Results, 2023 SASE Series: SSE Leads the Way Toward SASE, August 2023. 
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Figure 6. Percentage of Organisations Adopting Zero-Trust Initiatives 


Does your organisation currently have a zero trust initiative underway? 
(Percent of respondents, N=390) 
No, but we are No, and we currently 
actively planning a have no plans for a 
zero-trust initiative, zero-trust initiative, 
3% 1% 


Yes, we have begun 
to implement zero- 
trust initiatives for 
certain use cases, 


30% Yes, we have a broad 


zero-trust initiative 
underway, 67% 


Source: Enterprise Strategy Group, a division of TechTarget, Inc. 


However, organisations face challenges implementing least privilege access for their applications across multi-cloud 
and hybrid environments, including facilitating collaboration between IT, operations and security teams; providing 
secure access from a range of devices; managing costs; ensuring data security; maintaining performance; and 
providing comprehensive visibility and reporting. 


Therefore, organisations should look for a solution that satisfies both hybrid and multi-cloud environments, 
integrating a zero-trust approach. Such a solution would help organisations mitigate risk while optimising 
operational efficiency, helping IT, networking and security teams to protect their applications across environments. 


Introducing Cisco Cloud Protection Suite 


The Cisco Cloud Protection Suite delivers a modern application security approach with end-to-end security for 
hybrid and multi-cloud application environments. From bare metal to cloud-native, the Cloud Protection Suite 
provides customers with holistic application security, safeguarding workloads across environments — on prem and 
in the cloud. 


Cisco Cloud Protection offers the following: 


e Comprehensive hybrid and multi-cloud security. With Cisco’s Cloud Protection Suite, users can efficiently 
and effectively manage security risk across environments. 


e Pervasive visibility into all assets. Providing a clear view of every network, application and cloud asset 
enables organisations to validate security posture and prioritise risks to the business. 


e Consistency across environments. Cisco’s suite facilitates the application of security frameworks, controls 
and compliance policies to mitigate risk and meet industry best practices. 


e Optimised remediation efficiency. Cisco’s suite utilises risk scoring powered by data science for prioritisation 
of vulnerabilities that pose real risk across the hybrid environment. 


e Application protection. Safeguarding traffic across the network, clouds and VPCs, the suite enables 
consistent and accurate macro and micro-segmentation across environments. 


e Least privilege access with a zero-trust approach. Cisco Cloud Protection leverages ZTNA to protect 
workloads on prem and in the cloud, reducing the attack surface area and preventing lateral movement. 
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Using the Cisco Cloud Protection Suite to manage application security across cloud environments, customers can: 


e Reduce operational overhead and optimise resources. 

e Mitigate security risk by prioritising vulnerabilities according to risk. 
e Facilitate meeting compliance regulations. 

e Respond more quickly to threats with comprehensive visibility. 


e Enable digital transformation to support business growth. 


Conclusion 


As organisations increasingly move workloads to the cloud to optimise productivity, security teams face challenges 
protecting their applications across environments and keeping up with business growth. The complexity of 
supporting applications across hybrid and multi-cloud environments while enabling cloud migration or even 
repatriation requires a unified, flexible approach. 


The Cisco Cloud Protection Suite provides an effective way for security teams to manage application security 
across multiple clouds and data centres. By providing comprehensive visibility and least privilege access control, it 
provides a holistic and effective method for securing assets and applications across the entire environment. Offering 
a cohesive way to manage risk with automation, consistency across environments and consolidated security tools, 
also reduces manual tasks to optimise efficiency across IT, network and security teams. 


With Cisco Cloud Protection Suite, security teams are better equipped to support business growth and digital 


transformation, including scaling development teams, adoption of new technologies, and mergers and acquisitions 
that keep businesses competitive. 
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